changepassword vs. setpassword in Windows 2000

From: glchen (anonymous_at_discussions.microsoft.com)
Date: 02/04/04 

Date: Wed, 4 Feb 2004 13:23:34 -0800

Is there any way to force setpassword API call to be
validated by Windows password policies?

Background:
There are two AD programmatic and GUI interfaces to update
AD password. One is to "change password" and the other is
to "reset password". Change password requires the old
password/newpassword. Reset(set) password does not
require the old password.
AD password policy enforcement seems to only impact on the
change password cases. "Reset password" seems to bypass
the checking of password policy settings

I implemented a self-service password update website which
allows users to reset password if users provide correct
security data (so called attribute-based authentication).
This self-service password uses "set password" API (not
change password) since self-service password website is
mainly used by the users who forgot his password or his
password expired (use attribute-base authentication).

.

Relevant Pages

  • Is there any way to force setpassword API call to be validated by Windows passwo
    ... Is there any way to force setpassword API call to be ... One is to "change password" and the other is ... "Reset password" seems to bypass ... This self-service password uses "set password" API (not ...
    (microsoft.public.win2000.active_directory)
  • Re: Is there any way to force setpassword API call to be validated by Windows passwo
    ... One is to "change password" and the other is ... "Reset password" seems to bypass ... > This self-service password uses "set password" API (not ... > password expired (use attribute-base authentication). ...
    (microsoft.public.win2000.active_directory)
  • Re: Change Password Permissions
    ... Reset password is setting the password to a new value without caring about ... Change password requires you to ... Administrator has the rights to reset the password of the other users. ... data then the encrypted data will be lost after password reset. ...
    (microsoft.public.win2000.security)
  • reset password/change at next logon
    ... We have delegated the 'reset password' authority to our helpdesk. ... they are abusing this function by changing the password but NOT checking ... the box that says 'user must change password at next logon'. ...
    (microsoft.public.win2000.security)